Vector35 / Vector35/binaryninja-api

Improve ARM/Thumb support

Open
#6,381 3 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Architecture Component: Core Effort: Medium Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Binary Ninja struggles to be useful in the face of Thumb code in ARM binaries. In an mixed-mode ARM/Thumb binary calls between ARM and Thumb code use the "BLX" instruction instead of "BL". This signifies that the LSB of the target address is a Thumb function and the processor must change mode to Thumb mode to execute it.

However, that means there are "odd" function pointers within the code and data that need special handling. Further, when you follow such an "odd" pointer, it brings you to the specific address and not the aligned address. In ARM (Thumb or not), and instruction can NEVER have its first byte on an odd address.

If a function is later identified to be Thumb vs. ARM it doesn't seem possible to change this setting. Maybe I'm missing how, since I'm relatively new to Binary Ninja (but I have decades of IDA experience).

I can't be certain about every platform/OS/compiler/etc, but at least with GNU binaries (like Android) there are often symbols that pointer directly to the start of arm or thumb functions and specify the type. These are often seen as "$t" or "$a" in the symbols.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by locating the existing ARM and Thumb analysis paths, then inspect how BLX targets, odd function pointers, alignment, and GNU $t/$a symbols are represented. Done should include reliable mixed ARM/Thumb handling and a way to update a function's mode after identification.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.